Hackers Got Inside a Flock Camera

	Hackers Got Inside a Flock Camera(wired.com)
	567 points by driverdan 27 days ago \| 262 comments
	tl;dr: Hackers physically removed a Flock ALPR camera, extracted an encryption key stored on the device itself, and shared the decrypted contents with 404 Media and WIRED, revealing that the cameras run ~20 Android apps that detect people (not just vehicles), sometimes misidentify bumper stickers and flag patches as license plates, and generate massive image volumes (~1.6M images over 21 days). No face-recognition capabilities beyond default Android were found, but the leak contradicts Flock's claims that on-device encryption would protect footage from anyone with physical access.
	HN Discussion: ↑Flock's security practices are incompetent, with hardcoded credentials and inadequate encryption ↑Flock's vulnerability disclosure policy is designed to discourage real security research ↑This is the result of lazy engineering that ignored the obvious physical-access threat model ↑Flock's denials about facial recognition are misleading since the broader system enables it ↓Camera security matters less because images are from public spaces and real processing happens server-side